T09 · Insecure Skill Coding Practices
Warning
- Location
templates/TOOLS.md:10- Finding
Plaintext API Key Storage Encouraged in Agent Workspace
- Content
View full analysis
- Remediation
View remediation
Security audit
Quick Team
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent, but its reusable templates can persist API keys and someone else's personal profile into generated agent workspaces.
Review and edit the templates before installing or using this skill. Replace the API-key instruction with environment-variable or secret-manager references only, remove the hard-coded personal profile from MEMORY.md, and keep allowAgents limited to specific agent IDs unless you explicitly need broader spawn access.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
templates/MEMORY.md:7- Finding
Personal Information Hard-Coded into a Reusable Persistent-Memory Template
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Declaring
execfor Python/shell execution is materially over-privileged for a skill whose purpose is generating folder structures and configuration files. Command execution creates a direct path to arbitrary code execution, filesystem modification, and chained abuse if an attacker can influence prompts or generated commands.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The description requires operation in Chinese (for example, "用自然语言快速创建") and the document consistently prescribes Chinese-specific conventions, while offering no language or locale choice. This constitutes a language policy issue because the skill appears to enforce a specific language context without explicit user opt-in or documented locale justification.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad everyday-language requests such as creating a member, adding a role, or making a new agent, which can cause the skill to activate during ordinary conversation without clear user intent to modify configuration. In this skill's context, accidental activation is more dangerous because the documented workflow includes creating files, editing ~/.qclaw/openclaw.json, expanding allowAgents, and potentially restarting the gateway.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill name, persona, and operating description are entirely in Chinese and do not offer any language choice or indicate that Chinese is optional. This can amount to an implicit language policy constraint without user opt-in.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The description says the skill is called whenever the controller needs to collect information, do competitor analysis, or organize information, but it does not define concrete trigger phrases, scope limits, or exclusion conditions. These tasks are common and broadly phrased, which could lead to unintended invocation in many routine assistant workflows.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The memory file hard-codes a Chinese-language persona, timezone, and user profile without any indication that this context was explicitly chosen by the end user. In a reusable assistant skill, this can silently bias outputs, override user expectations, and cause privacy or personalization issues by imposing locale and identity assumptions that may not apply.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire skill definition is written in Chinese and specifies fixed report phrasing such as '【研究助手】主题 + 3 条核心发现 + 来源链接' without indicating that users may choose another language. This creates a natural-language locale constraint that is not presented as optional or justified as region-specific.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill is described as creating local directory structures and configuration templates, but its tool list adds network search and webpage retrieval capabilities that are not necessary for that stated purpose. Unnecessary network-capable tools expand the attack surface, enable data exfiltration or prompt-driven scope creep, and make it easier for the agent to access untrusted external content during a task that should remain local and deterministic.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown template specifies all user-facing field guidance in Chinese, which effectively imposes a language choice on downstream users without indicating any option to use another language. Under the policy for natural-language violations, forcing a specific language without user opt-in is in scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The template content is written entirely in Chinese, including headings and guidance text, which implicitly forces a specific language/locale for users of the skill. There is no indication that language choice is optional or that the template is intended only for a Chinese-speaking or region-specific context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The template headings and instructions are entirely in Chinese, which implicitly requires the skill author and likely downstream agent behavior to operate in a specific language. There is no indication that users can choose another language or that the Chinese-only constraint is justified by a region-specific requirement.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file's headings and instructional text are entirely in Chinese, which can impose a specific language on downstream skill authors or users. There is no indication that the skill is region-specific or that another language may be used, so this appears to violate the language/locale choice policy.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The instruction "用中文拼音首字母" imposes a Chinese-language naming convention for generated IDs regardless of user preference. Because the file does not offer an alternative naming scheme or explain that this skill is region-specific, the rule reflects a locale-specific requirement without opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The instructions state that Chinese content should be prioritized and distinguish behavior by language, but they do not offer the user a language or locale choice. This is a natural-language policy concern because it imposes a language preference without explicit opt-in or a documented region-specific justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Lines L09-L21 present the operative template guidance in Chinese, with no indication that users may choose another language or that the template is region-specific. This creates a natural-language locale policy concern because the skill implicitly enforces a specific language without user opt-in.
- Content